Explicitly label .origin files as configuration

subscription-manager has a daemon that runs in a confined domain,
and it doesn't have permission to write usr_t, which is the default
label of /ostree/deploy/$osname/deploy.

A better long term fix is probably to move the origin file into the
deployment root as /etc/ostree/origin.conf or so.

In the meantime, let's ensure the .origin files are labeled as
configuration.

src/libostree/ostree-sysroot-deploy.c

@@ -1893,13 +1893,6 @@ ostree_sysroot_deploy_tree (OstreeSysroot     *self,
       goto out;
     }
 
-  if (!ostree_sysroot_write_origin_file (self, new_deployment, NULL,
-                                         cancellable, error))
-    {
-      g_prefix_error (error, "Writing out origin file: ");
-      goto out;
-    }
-
   /* Create an empty boot configuration; we will merge things into
    * it as we go.
    */
@@ -1915,6 +1908,9 @@ ostree_sysroot_deploy_tree (OstreeSysroot     *self,
       goto out;
     }
 
+  g_clear_object (&self->sepolicy);
+  self->sepolicy = g_object_ref (sepolicy);
+
   deployment_etc = g_file_get_child (new_deployment_path, "etc");
 
   if (!selinux_relabel_var_if_needed (self, sepolicy, deployment_var,
@@ -1925,6 +1921,29 @@ ostree_sysroot_deploy_tree (OstreeSysroot     *self,
                                              cancellable, error))
     goto out;
 
+  { ostree_cleanup_sepolicy_fscreatecon gpointer dummy = NULL;
+
+    /* Explicitly override the label for the origin file to ensure
+     * it's system_conf_t.
+     */
+    if (self->sepolicy != NULL
+        && ostree_sepolicy_get_name (self->sepolicy) != NULL)
+      {
+        if (!ostree_sepolicy_setfscreatecon (self->sepolicy,
+                                             "/etc/ostree/remotes.d/dummy.conf",
+                                             0644,
+                                             error))
+          goto out;
+      }
+
+    if (!ostree_sysroot_write_origin_file (self, new_deployment, NULL,
+                                           cancellable, error))
+      {
+        g_prefix_error (error, "Writing out origin file: ");
+        goto out;
+      }
+  }
+
   /* After this, install_deployment_kernel() will set the other boot
    * options and write it out to disk.
    */